我想把Lambda中的一个文本文件从B账户放到A账户的S3存储桶。S3存储桶(test-bucket)使用aws/s3托管密钥进行AWS-KMS加密。 1. 我在A账户的S3存储桶(test-bucket)中添加了以下权限:
```
{"Version": "2012-10-17",
"Id": "ExamplePolicy",
"Statement": [
{
"Sid": "ExampleStmt",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::AccountB:role/Lambda-Role"
},
"Action": "s3:*",
"Resource": "arn:aws:s3:::test-bucket/*"
}
]
}
- Added below inline policy to my Lambda execution role in Account B:
{"Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:DescribeKey", "kms:ReEncrypt*" ], "Resource": [ "arn:aws:kms:us-west-2:AccountA:key/AWS-KMS-ID" ] } ] }
这是我的 Lambda 代码:
res = s3.put_object(
Body=message,
Key=file_name,
Bucket='test-bucket',
ACL='bucket-owner-full-control'
)
在从帐户B Lambda运行此代码时,出现以下错误:
An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
由于S3存储桶采用AWS托管密钥进行加密,因此我无法编辑KMS策略,对于客户托管密钥的情况,我们该怎么做呢?请有经验的人士指导一下,我漏掉了什么吗?